Two-Factor Authentication Methods Compared: Which to Turn On

What a second factor is

CISA, the US cybersecurity agency, describes multi-factor authentication as a layered approach: a service asks for a second piece of evidence beyond the password, drawn from a different category. The categories are something you know (a password or PIN), something you have (a phone, a security key, a printed code list) and something you are (a fingerprint or face). Two things from the same category are not two factors. CISA's summary of the effect: users who enable MFA are significantly less likely to get hacked, because a stolen password alone no longer opens the account.

The methods, compared

"Phishing resistant" is the column that matters. NIST SP 800-63B is explicit: passwords, look-up secrets, out-of-band codes and one-time-password apps are not phishing resistant, because typing a code into a page does not bind it to the real site; whatever you type into a convincing fake can be relayed to the real service within seconds. Phishing resistance requires a cryptographic authenticator, and NIST names WebAuthn, used by FIDO2 passkeys and security keys, as the example. CISA says the same from the other side: FIDO/WebAuthn is the only widely available phishing-resistant authentication, and it urges organisations to plan a move to it.

From strongest to weakest

1. Passkeys and hardware security keys. The site sends a challenge, your device signs it with a private key the site never sees, and the signature is tied to the site's real domain. A fake domain gets a signature it cannot use. Passkeys live on your phone or computer and sync between devices; a hardware key is a small USB or NFC device that does the same job offline.
2. Authenticator app codes (TOTP). The app and the server share a secret, set up by scanning a QR code, and both compute the same six-digit code every 30 seconds. Nothing travels over the phone network, so SIM swaps do not matter, but a code typed into a phishing page still works on the real site until it expires.
3. Push with number matching. The login screen shows a number that you must enter in the app. CISA recommends number matching where phishing-resistant MFA is not yet possible, because it defeats the trick of sending prompts until a tired user taps approve.
4. Plain push prompts. A simple "Approve?" dialog. NIST's current revision no longer accepts approval-only prompts; if a service offers both, pick number matching.
5. SMS and voice codes. NIST classes out-of-band authentication over the public phone network as restricted: it still counts as a factor, but the service has to treat it as weaker and watch for signs such as a recent SIM change or number port before sending a code. Better than nothing, and the first thing to replace.
6. Email codes. NIST says email shall not be used for out-of-band authentication; the mailbox is usually protected by the same kind of password the second factor is meant to back up.

Setting it up, in order

1. Start with the accounts that unlock the others: the email account used for password resets, then banking, then the password manager, then everything else.
2. Pick the strongest option each service offers: a passkey or security key where available, otherwise an authenticator app, otherwise SMS.
3. Register two of them. Two security keys, or passkeys on two devices, or an app plus a key. A single phone is a single point of failure.
4. Save the backup codes the service shows at setup. NIST's name for them is look-up secrets: each works once, so store the list where a lost phone cannot take it, such as a password manager or a printed sheet.
5. Keep the password strong anyway. NIST sets 15 characters as the minimum for a password used by itself, 8 when it is one of two factors; the password generator produces one and the password strength checker estimates how long it would take to guess. The password length guide explains the NIST rules.

What the QR code at setup contains

When an authenticator app is set up, the service shows a QR code that encodes the shared secret, the account name and the issuer, in a standard URI the app reads once. That secret is the whole security of the method, so the code should not be screenshotted and left in a photo roll; many services let you view it as text to type into a second device at the same time, which is the moment to register a backup app. The QR code generator shows what such URIs look like if you want to understand the format, and the hash generator is a way to see the one-way functions that the codes are built from, though neither is needed to use two-factor authentication.

What two-factor authentication does not do

• It does not protect a session that is already logged in. Malware on the device, or a stolen session cookie, bypasses the login entirely.
• It does not protect account recovery flows that fall back to email or security questions; check what the service does when "I lost my second factor".
• A non-phishing-resistant factor does not protect against a real-time phishing page that relays your code. For accounts that matter, that is the argument for passkeys.

Frequently asked questions

Sources

• CISA: Multifactor authentication (the three factors; users with MFA are significantly less likely to be hacked; FIDO/WebAuthn as the only widely available phishing-resistant authentication; number matching; any MFA is better than no MFA)
• NIST SP 800-63B rev. 4: authenticator types, restricted status of PSTN (SMS and voice) out-of-band authentication, email not allowed for out-of-band, approval-only prompts no longer acceptable, phishing resistance requires cryptographic authenticators, and the 15-character rule for passwords used alone

Written by Tobias. Updated October 20, 2026.